The Coordinated Vulnerability Disclosure (CVD) Program

Submit a Vulnerability 

To report a vulnerability for coordination, use our CVD platform Vulnerability Information and Coordination Environment - New Technologies (VINCE-NT), sponsored, hosted, and managed by CISA. For more information, see Frequently Asked Questions.

About CVD

Overview

CISA plays a vital role in safeguarding national and economic security by coordinating the identification, remediation, and disclosure of cybersecurity vulnerabilities that pose risks across critical infrastructure and other essential technologies. This coordination includes vulnerabilities affecting a broad spectrum of technologies such as: 

• Operational technology (OT) and industrial control systems (ICS), 

• Internet of things (IoT) devices,   

• Medical devices, 

• Open source software, 

• Artificial intelligence (AI), 

• and IT systems.  

 

Through our Coordinated Vulnerability Disclosure (CVD) program, CISA facilitates the timely and synchronized dissemination of vulnerability information and any associated mitigations if available. This process ensures that all relevant stakeholders—including vulnerability reporters, software manufacturers, maintainers, end users/customers, services providers—receive critical information simultaneously, thereby minimizing the window of exploitation and enabling rapid risk mitigation across diverse environments  

As an active leader in the CVE Program, CISA's CVD program operationalizes the CISA Top Level Root and the CVE Numbering Authority (CNA) of Last Resort responsibilities by assigning CVE identifiers to vulnerabilities reported to CISA. These functions strengthen the global vulnerability management ecosystem by promoting transparency, fostering trust amongst stakeholders, and supporting a coordinated, systematic response to cybersecurity risks affecting critical infrastructure. For more on CISA's role in the CVE Program, see the CVE program structure. 

Program Impact

The Coordinated Vulnerability Disclosure (CVD) Program is a key part of CISA's mission to protect critical infrastructure and bolster national cybersecurity. By identifying, addressing, and publicly disclosing cybersecurity vulnerabilities, the program reduces risks to essential systems. CISA works with stakeholders to quickly share actionable mitigation strategies, limiting exploitation opportunities and improving cybersecurity resilience. This collaborative approach builds trust, transparency, and a stronger global cybersecurity ecosystem, ensuring the safety of vital infrastructure. 

Authorities

CISA has broad authority to detect, identify, and receive information "for a cybersecurity purpose about security vulnerabilities relating to critical infrastructure in information systems and devices." 6 U.S.C. 659(c)(12). Where a "security vulnerability" means any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of a security control. 6 U.S.C 650(25). The Secretary, in coordination with industry and other stakeholders, may develop and adhere to Department policies and procedures for coordinating vulnerability disclosures. 6 U.S.C. 659(n).

The CVD Process

The CVD Process:     

1. Vulnerability Report Submission  

An individual (researcher, supplier, etc.) identifies a suspected vulnerability and reports it to CISA through VINCE-NT.  

2. CVD Intake and Triage

CISA’s Coordinated Vulnerability and Disclosure (CVD) team performs an initial triage to determine if the vulnerability: 

• CISA’s Coordinated Vulnerability and Disclosure (CVD) team performs an initial triage to determine if the vulnerability
  • Appears legitimate 
    • Is actionable
    • Is in scope of CISA’s CVD program 
    • Is already known to the vendor or publicly disclosed, including whether it may already have an associated CVE 
    • Meets criteria for coordination 
  • Outcomes
    • In scope → CVE
    • Out of scope → Referred / closed
      • Note: If referred, the report is valid but better handled by another organization or vendor, so CISA directs the reporter to the appropriate channel.

3. CVD Coordination

• Once accepted, the case moves into coordinated disclosure where CISA performs: 
  • Supplier identification & outreach 
  • Technical analysis of vulnerability details and vendor confirmation
  • Timeline tracking
  • Mediation between reporter and vendor when needed
  • Drafting of clear, publication-ready advisory ready language

4. CVE Record Determination (If Applicable)  

• If the vulnerability appears to meet CVE Program rules, CISA determines whether it should receive a CVE ID and identifies which CVE Numbering Authority (CNA) is responsible for creating and publishing the CVE record.  As a CNA, CISA may serve as the authoring CNA when appropriate, ensuring that vulnerabilities reported directly to CISA receive timely, accurate, and standardized CVE documentation 
• Once a CNA is identified, that CNA will reserve the CVE ID and gather the information necessary for publication as part of the CVE Program process.  

5. Advisory Development and Publication Prep 

• CISA and case participants align on:  
  • Final advisory text 
  • Timeline for publication 
  • Coordination with supplier and researcher disclosure plans 
  • Cross-stakeholder alignment  

6. Public Disclosure 

• CISA Publishes: 
  • CISA Advisory 
  • Publish CVE Record enriched content 
  • CSAF 
• Reporters and Vendors are notified of publication

7. Known Exploited Vulnerabilities (KEV) Evaluation and Publication

• The process continues with the Known Exploited Vulnerabilities (KEV) Evaluation. For more information, please visit our VINCE-NT GitHub.

Public Disclosure

CISA discloses vulnerabilities through multiple channels to ensure that users receive complete, accurate, and timely information about vulnerabilities and mitigations. Disclosure may include publishing a CVE Record, a comprehensive vulnerability advisory, and/or associated public messaging. 

Disclosure Timeline  

The timeline for disclosure may depend on factors including: 

• Disclosure Status. Whether the vulnerability has been publicly disclosed or is actively exploited. 

• Potential Impact. The potential impact on critical infrastructure, national security, or public health. 

• Vendor Responsiveness. In cases where a vendor is unresponsive or will not establish a reasonable timeframe for remediation, CISA may disclose vulnerabilities as early as 45 days after the initial attempt to contact the vendor is made, regardless of the availability of a patch or update. 

• Mitigation Availability and Timeline. The timeline depends on whether mitigations are available and, if not, how long the vendor needs to create mitigations. 

CVD and the Vulnerability Equities Process (VEP)

Although CISA participates in the interagency Vulnerabilities Equities Process (VEP), vulnerabilities reported to CISA through the CVD process are no subject to VEP adjudication, per Section 5.4 of the VEP Charter. Lean more about VEP.

CISA Vulnerability Disclosure Process (VDP)

The Vulnerability Disclosure Process (VDP) is separate from CVD. While CVD focuses on coordinating vulnerabilities between researchers and suppliers—including triage, CVE assignment, remediation, and public advisory publication—VDP is about the policy and intake process for reporting issues in an organization’s own assets. 

VDP provides a clear, authorized way for security researchers and the public to report vulnerabilities they discover in an organization’s public facing systems. A VDP does not involve coordination, remediation, or advisory publication—instead, it simply establishes how an organization receives reports, what is in scope, and what reporters can expect. 

To learn more about CISA’s VDP services, visit the Vulnerability Disclosure Policy (VDP) Program page.